npm-publish-ci-pitfalls
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical reference for debugging npm publishing workflows in GitHub Actions. All instructions and examples provided follow standard industry practices for package development and CI/CD configuration.
- [SAFE]: External URLs referenced in the documentation (e.g., gh.io, npmjs.com, registry.npmjs.org) are official domains for GitHub and npm, which are well-known and trusted services.
- [SAFE]: The provided shell command examples are designed for local package inspection and verification, such as checking package manifests (
npm pkg fix) or smoke-testing a locally generated tarball. There are no patterns involving remote code execution or piped downloads from untrusted sources. - [SAFE]: The skill does not contain any obfuscated code, hidden instructions, or attempts to access sensitive local files or credentials.
Audit Metadata